add certbot

This commit is contained in:
Elizabeth Hunt 2024-03-17 19:24:23 -04:00
parent bb8e5c0ed8
commit c8cf576e33
9 changed files with 99 additions and 0 deletions

View File

@ -5,3 +5,6 @@
- name: Docker setup - name: Docker setup
ansible.builtin.import_playbook: playbooks/deploy-docker.yml ansible.builtin.import_playbook: playbooks/deploy-docker.yml
- name: Certbot certificate cloudflare setup
ansible.builtin.import_playbook: playbooks/deploy-certbot.yml

5
group_vars/certbot.yml Normal file
View File

@ -0,0 +1,5 @@
---
cloudflare_credentials_destination: /root/.cloudflare-dns-api-key.ini
certbot_post_hook_dir: /etc/letsencrypt/renewal-hooks/post
certbot_live_dir: /etc/letsencrypt/live

View File

@ -0,0 +1,7 @@
---
host_domains:
fern.hatecomputers.club:
- fern.hatecomputers.club
- auth.hatecomputers.club
- vpn.hatecomputers.club

View File

@ -1,2 +1,11 @@
[docker] [docker]
fern.hatecomputers.club ansible_user=root ansible_connection=ssh fern.hatecomputers.club ansible_user=root ansible_connection=ssh
[host_domains]
fern.hatecomputers.club ansible_user=root ansible_connection=ssh
[certbot]
fern.hatecomputers.club ansible_user=root ansible_connection=ssh
[kanidm]
fern.hatecomputers.club ansible_user=root ansible_connection=ssh

View File

@ -0,0 +1,6 @@
---
- name: Certbot setup
hosts: certbot
roles:
- certbot

View File

@ -0,0 +1,3 @@
#!/bin/bash
/usr/sbin/service nginx restart

View File

@ -0,0 +1,64 @@
---
- name: Install certbot deps
ansible.builtin.apt:
name:
- python3-certbot
- python3-certbot-dns-cloudflare
state: present
- name: Install
ansible.builtin.template:
src: cloudflare-credentials.ini.j2
dest: "{{ cloudflare_credentials_destination }}"
mode: o=rw
- name: Ensure existance of {{ certbot_post_hook_dir }}
ansible.builtin.file:
path: "{{ certbot_post_hook_dir }}"
state: directory
mode: o=rw,g=r,a+x
- name: Add renewal_post_upgrade hook
ansible.builtin.copy:
src: renewal_post_upgrade.sh
dest: "{{ certbot_post_hook_dir }}/renewal_post_upgrade.sh"
mode: a+x
owner: root
group: root
- name: Check for existence of certificates
ansible.builtin.stat:
path: "{{ certbot_live_dir }}/{{ item }}/fullchain.pem"
loop: "{{ host_domains[inventory_hostname] }}"
register: cert_check
- name: Construct domains needing ACME requests list
ansible.builtin.set_fact:
domain_request_list: >
{% for domain in host_domains[inventory_hostname] %}
{% set domain_index = loop.index0 %}
{% if not cert_check.results[domain_index].stat.exists %}
{{ domain }}
{% endif %}
{% endfor %}
- name: Request acmedns challenges if there are such domains that need certs
ansible.builtin.shell: >
certbot certonly --dns-cloudflare \
--dns-cloudflare-credentials {{ cloudflare_credentials_destination }} \
--non-interactive \
--manual-public-ip-logging-ok \
--agree-tos -m {{ certbot_email }} \
--preferred-challenges dns --debug-challenges \
--dns-cloudflare-propagation-seconds 20 \
-d {{ item }}
loop: "{{ domain_request_list.split() }}"
changed_when: domain_request_list | trim != ''
- name: Certbot daily renewal cron job
ansible.builtin.cron:
name: "letsencrypt_daily_renewal"
special_time: "daily"
job: "certbot renew --non-interactive"
cron_file: "certbot_renewal"
user: root

View File

@ -0,0 +1 @@
dns_cloudflare_api_token = {{ cloudflare_api_token }}

View File

@ -1 +1,2 @@
cloudflare_api_token cloudflare_api_token
certbot_email